Skip to content

Commit e0582bd

Browse files
(PA-6507) Update gem rexml from default to 3.2.9 for CVE-2024-35176
- The CVE was fixed from rexml version 3.2.7. - Patching for the CVE wasn't getting applied cleanly and had a lot of conflicts. So updated the gem version to 3.2.9 in the rexml component file. - rexml 3.2.7 requires strscan >= 3.0.9 which contains native extensions. We would need a compiler to build the extensions and there are jruby incompatibilities. This requirement has been relaxed starting from rexml 3.2.9. Therefore we update to rexml 3.2.9 here. - Added the change to _shared-agent-components since the CVE impacts both agent-runtime-main (ruby 3.2.4 using rexml 3.2.6) and agent-runtime-7.x (ruby 2.7.8 using rexml 3.2.3).
1 parent 0014ae7 commit e0582bd

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed
Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
component 'rubygem-rexml' do |pkg, settings, platform|
2-
pkg.version '3.2.6'
3-
pkg.md5sum 'a57288ae5afed07dd08c9f1302da7b25'
2+
pkg.version '3.2.9'
3+
pkg.md5sum '73fcf4d686d68dafbca57f941097ebf0'
44

55
instance_eval File.read('configs/components/_base-rubygem.rb')
66
end

configs/projects/_shared-agent-components.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
proj.component 'rubygem-gettext'
6262
proj.component 'rubygem-fast_gettext'
6363
proj.component 'rubygem-ffi'
64+
proj.component 'rubygem-rexml'
6465

6566
if platform.is_windows? || platform.is_solaris? || platform.is_aix?
6667
proj.component 'rubygem-minitar'

0 commit comments

Comments
 (0)